Documentation
¶
Overview ¶
Package guard supplies dependency-free pre-I/O hooks to configuration loaders. The policy admission adapter installs the evaluator; collectors never import CI.
Index ¶
- Constants
- func CanonicalFunction(name string) string
- func Enabled(kind string) (bool, error)
- func Function(ctx context.Context, name, engine string, origin Origin) error
- func FunctionAt(ctx context.Context, name, file string) error
- func FunctionValue(ctx context.Context, name, value string) error
- func IsPolicyError(err error) bool
- func RegisterRemote(path, source string)
- func RememberNode(node *yaml.Node, origin Origin)
- func RememberTree(value any, origin Origin)
- func RememberValue(value string, origin Origin)
- func ResetOrigins()
- func SaveHooks() func()
- func SetEnabled(enabled func(string) (bool, error))
- func SetEvaluator(evaluate func(context.Context, string, json.RawMessage) error)
- func Source(ctx context.Context, operation, raw, sourceFile string) error
- type FunctionInput
- type Origin
- type SourceInput
Constants ¶
const OperationTemplateDatasource = "template.datasource"
OperationTemplateDatasource names a source read through a template datasource.
Variables ¶
This section is empty.
Functions ¶
func CanonicalFunction ¶
CanonicalFunction returns the name a policy rule sees for a YAML function.
func FunctionAt ¶
FunctionAt checks a YAML function with its parser-provided source file. It lives in guard rather than admission so that low-level packages such as pkg/utils can admit functions without importing the CI reporting that admission pulls in, which would form an import cycle.
func FunctionValue ¶
FunctionValue checks lazy YAML functions using conservative parse-time attribution.
func IsPolicyError ¶
IsPolicyError identifies failures which optional imports must never suppress.
func RegisterRemote ¶
func RegisterRemote(path, source string)
RegisterRemote associates cached files/directories with their remote origin.
func RememberNode ¶
RememberNode retains attribution for every scalar of a spliced YAML document before its next evaluation pass. Spliced includes keep their tags instead of decoding to Go values, so their function arguments need the same origin RememberTree records for decoded includes.
func RememberTree ¶
RememberTree retains attribution for included scalar values before their next evaluation pass.
func RememberValue ¶
RememberValue conservatively retains remote attribution through merges and lazy evaluation. Identical values from multiple sources take the more restrictive provenance.
func ResetOrigins ¶
func ResetOrigins()
ResetOrigins isolates source attribution between CLI invocations.
func SaveHooks ¶
func SaveHooks() func()
SaveHooks captures the installed capability lookup and evaluator and returns a function that reinstalls them. Tests that replace the hooks with fakes use it to restore the wiring they found.
func SetEnabled ¶
SetEnabled installs the capability lookup used to preserve unconfigured behavior.
func SetEvaluator ¶
SetEvaluator connects collectors to admission without introducing dependency cycles.
Types ¶
type FunctionInput ¶
FunctionInput identifies a YAML or template function without its secret arguments.
type Origin ¶
Origin records execution provenance, independently of the optional display provenance.
func FileOrigin ¶
FileOrigin never infers that an unattributed value was authored locally.
func ValueOrigin ¶
ValueOrigin retrieves attribution retained while parsing, or reports unknown.
type SourceInput ¶
type SourceInput struct {
Operation string `json:"operation"`
Scheme string `json:"scheme"`
Host string `json:"host"`
Path string `json:"path"`
Remote bool `json:"remote"`
PathResolved bool `json:"path_resolved"`
Origin
}
SourceInput describes the actual destination immediately before a read or download.
func DescribeSource ¶
func DescribeSource(operation, raw, sourceFile string) (SourceInput, error)
DescribeSource normalizes transport syntax without fetching or exposing credentials.
Source Files